cisco access list?

[antonis4]

exo ena 803 isdn routeraki kai thelo sen ena xrhsth na tou kopso thn porta 80.xrhsimopoio nat kai o xrhsths einai o 192.168.0.139

mporei kapoios na mou grapsei thn entolh kathos pou tha thn kano bound?

[TheNetPoet]

access-list 110 deny tcp host 192.168.0.139 any eq 80

access-list 110 permit tcp any any

 

to prwto apagoreuei apo to 192.168.0.139 pros opoudhpote sto port 80

to deytero epitrepei ola ta ypoloipa... fysika prepei na baleis kai to access list sto lan interface, px

 

interface ethernet 0

access-list 110 out

[antonis4]

eyxaristo katarxhn gia thn apanthsh alla otan to kano ayto kanenas den mporei na katebasei.se olous kobetai o explorer.mhpos prepei na thn balo sto dialer?

[TheNetPoet]

periergo re file, eprepe na paizei kanonika afou to access list einai specific gia to host, ara to matching einai gia 1 ip mono kai ola ta alla allow.

dokimase sto dialer interface an kai periergo to blepw na ftaiei auto. an den pai3ei pes mou na to psa3w....

epishs an 0es, kane ena show run kai grapse to configuration tou router sou na dw ti paizei...

[antonis4]

Current configuration : 1577 bytes

!

version 12.2

no service pad

service timestamps debug uptime

service timestamps log uptime

service password-encryption

!

hostname Cisco803

!

logging queue-limit 100

enable password 7 011A08105E1905072441

!

!

pots country US

ip subnet-zero

!

ip name-server 194.30.220.114

isdn switch-type basic-net3

!

!

!

interface Ethernet0

description connected to EthernetLAN

ip address 192.168.2.5

ip nat inside

!

interface BRI0

description connected to Internet

no ip address

ip nat outside

encapsulation ppp

dialer rotary-group 1

isdn switch-type basic-net3

no cdp enable

!

interface Dialer1

description connected to Internet

ip address negotiated

ip nat outside

encapsulation ppp

no ip split-horizon

dialer in-band

dialer idle-timeout 300

dialer string 8962577777

dialer hold-queue 10

dialer load-threshold 10 outbound

dialer-group 1

no cdp enable

ppp authentication chap pap callin

ppp chap hostna

ppp chap password 7 02021E085F5F597218175F5A

ppp pap sent-username interche password 7 13010D415F5552797F7D7E70

ppp multilink

!

router rip

version 2

passive-interface Dialer1

network 192.168.2.0

no auto-summary

!

ip nat inside source list 1 interface Dialer1 overload

ip http server

ip classless

ip route 0.0.0.0 0.0.0.0 Dialer1

!

access-list 1 permit 192.168.2.0 0.0.0.255

dialer-list 1 protocol ip permit

snmp-server community public RO

snmp-server enable traps tty

!

line con 0

exec-timeout 0 0

password 7 094D4

login

stopbits 1

line vty 0 4

password 7 045A0512002F455D5E4C

login

!

no rcapi server

!

!

end

[TheNetPoet]

kat' arxhn mpes ston provider sou kai alla3e AMESWS to password sou ka0ws kai to enable password kai vty password, kakws ta ekanes kai auta paste mazi me to configuration giati einai tromera eukolo na to brei kapoios akoma ki an einai encrypted.

 

0a to melethsw kai 0a sou pw, mia prwth parathrhsh einai oti den blepw poy0ena to IP poy moy eipes (192.168.0.139)...

[antonis4]

nai ekana lalakia xehasa na krypso to dekaexadiko,alla to exo hdh allaxei.

den exo thn access list enable giati mou kolane ola ta pc sthn 80.

[TheNetPoet]

dokimase to parakatw meta to

access-list 1 permit 192.168.2.0 0.0.0.255

bale kai

access-list 1 deny tcp host 192.169.2.39 any eq www

an den pai3ei mallon 0elei deny ston dialer an kai ston diko mou router opws sto egrapsa sto prwto moy post paizei kanonika

[zlimvos]

Prwton xreiazesai panw apo 100+ noumero sthn access list gia na kopseis sygkekrimenes porta (aka extended access list)

opote:

access-list 101 deny tcp host 192.168.0.139 any eq 80

access-list 101 permit ip any any

 

int ethernet0

ip access-group 101 OUT

 

prosoxh = to parapanw einai ama 8eloume na mhn mporei na dextei tcp paketa sthn porta 80

 

Ama 8eloume na mhn mporei na STEILEI paketa sthn porta 80 kapoiou web server (apo to pc sto internet):

int eth0

ip access-group 101 IN

 

rgrds